OpenAI adds a text watermark for EU ChatGPT and Codex, printing the limits beside the promises

On Monday 2026-10-05, OpenAI published a blog post setting out its phased response to the EU AI Act's text-transparency obligation, plus a ~20-page technical report on its new text watermarking method, textGrain.

FACT (CONFIRMED — OpenAI blog, verbatim phrasing of the three commitments).

"Starting today, API customers globally will be able to opt in to text watermarking for select models. Text watermarking will remain off by default in the API. … Over the coming weeks, we will add an invisible watermark to eligible ChatGPT and Codex text output in the European Union. … We're opening applications to access our text watermark detector. Access will initially be limited to approved researchers and expert organizations."

FACT (CONFIRMED — regulatory trigger). The EU AI Act, Article 50(2), requires providers of generative AI systems whose outputs are text, image, audio or video to mark outputs "in a machine-readable format and detectable as artificially generated or manipulated". The obligation applies since 2 August 2026 (Commission Code of Practice page, retrieved). The Commission has confirmed the voluntary Code of Practice on Transparency of AI-generated Content (published 10 June 2026) as an adequate tool to demonstrate compliance; Section 1 (providers) covers marking and detection; ~190 organisations had signed by end-July 2026.

FACT (CONFIRMED — grace period). Regulation (EU) 2026/1744 (the "digital omnibus on AI", in the Official Journal 24 July 2026) added paragraph 4 to Article 111 of the AI Act: systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with Article 50(2). ChatGPT and Codex are such systems, so OpenAI's "coming weeks" rollout fits inside the window (ActuIA).

FACT (CONFIRMED — what else happened the same day). Detector applications opened 2025-10-05 via OpenAI's content-provenance application form; the API opt-in setting ("Text provenance" under Data controls, org or project level, model selection) went live for select models worldwide; coverage of legacy models and cloud partners (The Decoder cites Microsoft Azure) was announced as "coming weeks".

What did NOT happen: no global default watermarking; no public detector; no user-identifying signal; no claim that the watermark proves authorship. OpenAI explicitly published the limits of its own mechanism in the same post — an unusual candour that several outlets (TechCrunch, The Hindu, ActuIA) picked up unaltered.

INTERPRETATION. The change is that text provenance — the hardest modality to watermark — moved from research demos and voluntary announcements into a production compliance configuration of the largest consumer AI product in Europe, with a named method, a published detection envelope, and a deliberately staged access model.

Concretely, five things changed on 2026-10-05:

1. Text watermarking became a real, documented product capability. Before this, OpenAI's provenance stack covered images and audio (Content Credentials/C2PA + SynthID watermarks + https://openai.com/verify + Content Provenance API) and text was the documented gap. Text is now covered by a named technology (textGrain) with a technical report and an operating point (target FP 1%).
2. A vendor set a de-facto EU compliance precedent for text. OpenAI is one of the Section 1 signatories of the EU Code of Practice. Its chosen approach — EU-only watermarking of consumer outputs, opt-in API, restricted detector — is now the reference configuration other providers will be measured against, and the terms of the debate (who gets detector access, is off-by-default-API compatible) are set by the first mover with flagship-scale EU consumer reach.
3. The 200-token / code-snippet exemption lines became load-bearing. The Code of Practice exempts "very short text" (<200 tokens, ~150 words in English) and code snippets from watermarking. OpenAI's published detection curve (80% at 200 tokens) shows why the exemption exists; the commercial consequence is that the most linguistically constrained and most professionally valuable outputs (short answers, math, code) are exactly the ones least covered by the watermark.
4. Detector access was explicitly staged by risk. One year of "free" AI-detection by the provider is refused; access is granted to approved researchers and experts, with authorities/media/fact-checkers served under the Code of Practice's controlled-free-access rules. The era of vendor-walled watermark detection for text began.
5. The comparison set formed. Anthropic watermarks Claude text globally (since 14 Aug 2026) and has a detection API in private preview; Google open-sourced SynthID Text in 2024; vLLM integrated a Gumbel-max watermark (Mistral + Red Hat engineers) on 24 Sept 2026. OpenAI now sits in a four-way, openly documented design space: global vs EU-only, public vs restricted detector, permissive vs staged access.

FACT (CONFIRMED — OpenAI blog + help center; mechanism corroborated by ActuIA's walkthrough of the technical report).

• Carrier. textGrain adds an invisible statistical signal to the model's word choices. It does not insert hidden characters, invisible spaces unusual punctuation or watermark-specific tokens. The signal lives in the words themselves, so it survives copy-paste.
• Generation. At generation time the sampler's randomness is partially replaced by pseudo-random values computed from a secret key and the preceding words. The technical report describes a partition of the vocabulary into blocks followed by an optimal-transport problem with Gumbel costs steering the choice of block; within the chosen block, words keep their original relative probabilities. Hundreds of these small nudges are agregated per passage.
• Entropy budget. The method is built around an "entropy budget" — the share of randomness the generator is willing to give up to create the signal. The authors present this as answering a known limitation of Gumbel-max watermarking: with the same key and the same prompt, Gumbel-max can produce identical responses, which is a problem for applications that request several variants of a text.
• Detection. The detector needs only the text and the secret key. It looks for the statistical pattern in word choices and reports whether an OpenAI watermark is present — without identifying the user or revealing prompts or conversations. The technical report notes the theoretical false positive rate rests on independence assumptions and that a deployed key requires empirical calibration.
• Operating point. Detector tuned to a target false positive rate of 1% (one in ~100 unwatermarked texts wrongly flagged).

FACT (CONFIRMED — published performance envelope, all COMPANY CLAIM).

HOW THE S09 LAB TESTS THIS (SIMULATE). runs a Monte Carlo detector (signal ∝ per-token entropy; threshold = empirical 99th percentile of unwatermarked text). It reproduces the full claimed shape — FP 1.02%; rising with length (68.2%→95.0% at 200→400 tokens flexible); flexible > constrained (95.0% vs 59.7% at 400 tokens); monotone collapse under editing (95.0% → 77.8% → 29.7%); copy-paste neutral (95.1%); translation destructive (1.05% ≈ FP). INTERPRETATION. The behavioural envelope is generic to aggregated per-token statistical watermarks, which makes the vendor figures plausible on their face — while remaining unverified at point level.

1. Text was the last major modality without a production provenance signal and it is the one that matters most for information integrity. Images and audio had C2PA/SynthID-style tooling; text is what flows through journalism government, HR, academia, enterprise comms. This is the first time a flagship-scale consumer text product in Europe gets a machine-readable detectable "generated" signal by default.
2. It converts an EU legal obligation from paperwork into an operating configuration. Before, Article 50(2) compliance for text was a policy/process question. Now there is a concrete technical artefact — a signal embedded in word choice — with measured error rates, an operating point, and an access model. That is exactly the shift from "a paper requirement" toward "a technically enforceable one" that predicted would matter to EU-operating enterprises.
3. It sets the compliance precedent for the rest of the Code of Practice signatories. OpenAI's staging (EU-only, off-by-default API, restricted detector) is now the commercial baseline. Anthropic's global approach becomes the counter-example, and regulators now have a live natural experiment comparing the two.
4. It makes the limits of the technology legally relevant, not just academically. Because the Code exempts <200-token text and code snippets and because the vendor's own curves show weak detection there, the regulatory boundary and the technical boundary are now visibly aligned with real consequences for what "compliance" actually covers in practice.

• A machine-checkable "OpenAI text" signal inside the EU — after rollout, eligible ChatGPT/Codex output in the EU carries a watermark detectable by an approved detector, even after copy-paste and light editing.
• Compliant-opt-in pipelines for API customers worldwide — an enterprise can now watermark its OpenAI-sourced output at generation time for its own transparency obligations, without bolting on a second detector.
• Independent evaluation of a vendor's watermark at scale — researchers and expert organisations can now evaluate the mechanism against real EU traffic; the applications channel exists as of 5 Oct.
• A regulatory audit unit. The Commission's guidelines and the Code now have an at-scale reference implementation to measure others against — including the unresolved question of whether "off by default" in APIs satisfies Article 50(2) for integrators.
• A natural experiment in vulnerability. The EU default watermark and the rest-of-world absence create a live, controlled comparison of evasion pressure (editing, translation, prompts engineered to lower entropy) — the first time such a comparison exists for text at consumer scale.

PREDICTION. The first published independent evaluations of textGrain's real-world detection rates will land within 3–6 months (in time for the 2 Dec 2026 omnibus deadline and the post-deadline market-surveillance cycle), and they will likely reproduce the shape of the vendor curves while disputing point values — most probably finding real-world FP/edited-text behaviour worse than the ELI5-labelled-prompt conditions in the report.

1. Does an off-by-default API flag satisfy Article 50(2) for an integrator under its own name when the option is available but disabled? The Commission guidelines do not address the disabled-option case. This is the single most commercially consequential open question for EU SaaS.
2. What are textGrain's real-world curves outside ELI5-labelled prompts — at 0.1% and 5% FP targets, on mixed-topic production traffic, on non-English-native input, on prompt-injected low-entropy text?
3. When does open-sourcing happen, and does it include key-management and rotation tooling? "We plan to make the technology available in open source" has no date and no scope.
4. Who actually gets detector access, and how fast? The case-by-case process has measurable outcomes (approval rate, latency, who was rejected); none are public. Media and fact-checkers have a Code-based claim — will it hold in practice?
5. How does evasion pressure move after rollout? The EU-only default creates the comparison population; the first evasion-transcript studies will be the test of the method's real robustness.
6. Will other signatories converge on EU-only or global defaults — and will the Commission's adequacy assessment of the Code treat divergent configurations as equivalent compliance?

FACT (CONFIRMED — announced timeline). EU ChatGPT/Codex watermarking rolls out "over the coming weeks"; API coverage extends to legacy models and cloud partners "in the coming weeks"; textGrain open-sourcing is planned without a date; the technical report will be updated.

FACT (CONFIRMED — regulatory calendar). The Article 50(2) compliance deadline for systems placed on the market before 2 Aug 2026 is 2 December 2026; the Commission's adequacy assessment of the Code and its Article 50 guidelines provide the interpretive frame; national market-surveillance authorities (EU) are the enforcement layer.

PREDICTION (next 3–6 months).

• First independent evaluations of textGrain's real-world curves appear before the 2 Dec 2026 deadline, likely confirming the shape and disputing point values — especially FP behaviour and editing robustness.
• At least one market-surveillance authority clarifies (or tests) the off-by-default API question; the first enforcement notice citing unmarked OpenAI-sourced text is more likely than not within two reporting cycles.
• The open-sourcing of textGrain either lands with key-management tooling (ecosystem change) or slips into a positioning statement (no change).
• Signatory divergence hardens: EU-only (OpenAI) vs global (Anthropic) configurations become the two documented compliance postures; Google, Meta, Microsoft and Mistral's text choices get read against both.
• Detector-access statistics (approvals, latency, rejections) become a contested transparency datapoint of its own before mid-2027.

Text provenance crossed a line on 5 October 2026: it stopped being a research problem and became a production configuration with legal teeth — and with the EU as the test market, the vendor as the referee, and the limits printed next to the promises. The honest headline of this story is not "OpenAI watermarks EU text". It is the shape of the trade-offs OpenAI published in the same post: 1%-FP operating points, ~80% on 200 tokens and ~17% after a quarter of the words are swapped, 42%–69% depending on the EU language, and a detector only approved researchers may touch. Enterprises in Europe now have a compliance decision to make — enable, mark, or document why not — and a deadline (2 December 2026) that is closer than the "coming weeks" of the rollout. The S09 research package gives them the mechanism, the measured envelope (with its confidence level honestly marked COMPANY CLAIM), the audit method, and the regulatory calendar. The future questions — who may verify, how keys age, how evasion evolves — are already visible in the vendor's own caveats.